Security and privacy

Calls can contain personal information. Configure your receptionist and destinations to collect and share only what your business needs.

Caller information and recordings

Call records can include recordings, transcripts, summaries, and caller details. Review the Privacy Policy and Terms. Your business is responsible for notices and permissions that apply to its callers and use of the service. Do not assume a default greeting satisfies every recording or automated-answering requirement.

Avoid asking for passwords, full payment-card details, or unnecessary sensitive information. Xaller.ai is not an emergency service. Do not use a general account for protected health information or assume healthcare-specific controls are available.

Protect your account and destinations

Use a strong, unique password and protect your email account. Never share verification codes. Review notification recipients, shared channels, connected accounts, and webhook destinations. Information delivered to another service is also subject to its access and retention controls.

Store webhook secrets on your server. Rotate a secret if it may have been exposed, and check that the receiver uses signature verification.

Sign-in email, data export and closing the account

These live in Settings:

• Sign-in & security: to change your sign-in email, enter the new address and your current password. We email a link to the new address; until you open it, the page shows Waiting for confirmation and you keep signing in with your current address. If you sign in with Google, your email follows your Google Account.
• Data & privacy → Download your data: the owner can request a ZIP of the account’s data once a day, confirming with the current password (or a two-step code for Google sign-in). We email you when it is ready; the download link works for 24 hours.
• Data & privacy → Close account: the owner confirms with the current password (or code) and types the business name. Your agent stops answering right away, billing ends at the end of the current period, your number is released, and recordings, transcripts and knowledge are deleted after 30 days.

Retention and requests

Call-content retention differs by plan. Account or billing records can have different retention requirements. For access, correction, deletion, or a suspected security issue, use the current Privacy Policy’s contact details or contact support. Request support where no self-service control is available.

Send the minimum needed to locate an issue, such as account email and call ID. Do not attach complete recordings or transcripts unless support requests them through an appropriate channel.